CVE-2026-1756: 
WordPress vulnerability analysis and mitigation

CVE-2026-1756 is an arbitrary file upload vulnerability in the WP FOFT Loader plugin for WordPress, caused by incorrect file type validation in the WP_FOFT_Loader_Mimes::file_and_ext function. It affects all versions of the plugin up to and including 2.1.39. Authenticated attackers with Author-level access or higher can exploit this flaw to upload arbitrary files, potentially enabling remote code execution. The vulnerability was published on February 4, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), stemming from improper validation logic in the WP_FOFT_Loader_Mimes::file_and_ext function within the plugin's MIME-handling class (Wordfence). The flawed validation fails to adequately restrict the types of files that can be uploaded, allowing attackers to bypass expected controls and place executable files (e.g., PHP web shells) on the server. Exploitation requires network access and a valid WordPress account with at least Author-level privileges — no user interaction or elevated complexity is needed. The vulnerable code is visible in the plugin's source repository at revision 3449144, lines 31 and 45 of class-wp-foft-loader-mimes.php (WordPress Trac).

Successful exploitation allows an authenticated attacker to upload arbitrary files — including PHP web shells — to the WordPress server, which can lead to full remote code execution. This results in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server. An attacker achieving code execution could pivot to other systems on the network, exfiltrate sensitive data, or establish persistent backdoor access (Wordfence, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability has an EPSS score of approximately 0.0025 (0.25%), indicating a currently low probability of exploitation in the near term. The vulnerability is detectable by Qualys (detection ID 530902) and was included in a CISA vulnerability bulletin for the week of February 2, 2026 (CISA Bulletin). No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the WP FOFT Loader plugin version 2.1.39 or earlier. This can be done by checking the plugin's readme.txt file (e.g., https://target.com/wp-content/plugins/wp-foft-loader/readme.txt) or using WordPress enumeration tools such as WPScan.
2. Obtain Author-level credentials: Acquire valid WordPress credentials with at least Author-level access through phishing, credential stuffing, or other means.
3. Authenticate to WordPress: Log in to the WordPress admin dashboard or use the REST API/XML-RPC with the obtained credentials.
4. Craft malicious upload request: Prepare a file with a dangerous type (e.g., a PHP web shell named shell.php) and craft an upload request targeting the plugin's file upload functionality, exploiting the flawed WP_FOFT_Loader_Mimes::file_and_ext validation to bypass MIME/extension checks.
5. Upload the malicious file: Submit the crafted request. Due to the improper validation, the server accepts and stores the file in an accessible web directory.
6. Execute the payload: Access the uploaded file via its URL (e.g., https://target.com/wp-content/uploads/shell.php) to trigger remote code execution and gain control of the server (Wordfence, WordPress Trac).

• File System: Unexpected PHP files (e.g., web shells) in WordPress upload directories such as wp-content/uploads/; files with double extensions (e.g., .php.jpg) or unusual MIME types in upload folders.
• Logs: WordPress or web server access logs showing POST requests to plugin upload endpoints by Author-level accounts, particularly with non-image or non-font file types; HTTP requests accessing newly uploaded .php files in the uploads directory.
• Network: Outbound connections from the web server process to unknown external IPs following a file upload event; unusual traffic patterns originating from the WordPress server.
• Process: Unexpected child processes spawned by the web server (e.g., Apache, Nginx, PHP-FPM) such as bash, curl, wget, or python (Wordfence).

A patch was committed to the plugin's repository (changeset 3453101), updating the class-wp-foft-loader-mimes.php file to correct the file type validation logic (WordPress Trac Changeset). Site administrators should update the WP FOFT Loader plugin to the latest version available in the WordPress plugin repository immediately. As interim mitigations: restrict Author-level and above access to only fully trusted users; monitor the wp-content/uploads/ directory for suspicious or executable files; and consider temporarily disabling the plugin if it is not critical to operations and a patched version is not yet available (Wordfence).

Wordfence, which assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for February 2–8, 2026 (Wordfence Blog). CISA referenced the vulnerability in its weekly vulnerability bulletin for the week of February 2, 2026 (CISA Bulletin). Qualys published detection coverage for the vulnerability in their February 2026 application security detections update (Qualys). Community coverage has been largely routine, with aggregation by security news feeds and vulnerability databases.